Use copying collector for out-of-line JSObject property storage

https://bugs.webkit.org/show_bug.cgi?id=76665

Reviewed by Geoffrey Garen.

* runtime/JSObject.cpp:
(JSC::JSObject::visitChildren): Changed to use copyAndAppend whenever the property storage is out-of-line.
(JSC::JSObject::allocatePropertyStorage): Changed to use tryAllocateStorage/tryReallocateStorage as opposed to
operator new.
* runtime/JSObject.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@105676 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index d273354..c5b6edc 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,16 @@
+2012-01-23  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Use copying collector for out-of-line JSObject property storage
+        https://bugs.webkit.org/show_bug.cgi?id=76665
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitChildren): Changed to use copyAndAppend whenever the property storage is out-of-line.
+        (JSC::JSObject::allocatePropertyStorage): Changed to use tryAllocateStorage/tryReallocateStorage as opposed to 
+        operator new.
+        * runtime/JSObject.h:
+
 2012-01-23  Brian Weinstein  <bweinstein@apple.com>
 
         More build fixing after r105646.

diff --git a/Source/JavaScriptCore/runtime/JSObject.cpp b/Source/JavaScriptCore/runtime/JSObject.cpp
index 653ddf0..19ca1e2 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSObject.cpp
@@ -24,6 +24,7 @@
 #include "config.h"
 #include "JSObject.h"
 
+#include "BumpSpaceInlineMethods.h"
 #include "DatePrototype.h"
 #include "ErrorConstructor.h"
 #include "GetterSetter.h"
@@ -83,11 +84,6 @@ static inline void getClassPropertyNames(ExecState* exec, const ClassInfo* class
     }
 }
 
-void JSObject::finalize(JSCell* cell)
-{
-    delete [] jsCast<JSObject*>(cell)->m_propertyStorage.get();
-}
-
 void JSObject::destroy(JSCell* cell)
 {
     jsCast<JSObject*>(cell)->JSObject::~JSObject();
@@ -106,7 +102,13 @@ void JSObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
 
     PropertyStorage storage = thisObject->propertyStorage();
     size_t storageSize = thisObject->structure()->propertyStorageSize();
-    visitor.appendValues(storage, storageSize);
+    if (thisObject->isUsingInlineStorage())
+        visitor.appendValues(storage, storageSize);
+    else {
+        visitor.copyAndAppend(reinterpret_cast<void**>(&storage), thisObject->structure()->propertyStorageCapacity() * sizeof(WriteBarrierBase<Unknown>), storage->slot(), storageSize);
+        thisObject->m_propertyStorage.set(storage, StorageBarrier::Unchecked);
+    }
+
     if (thisObject->m_inheritorID)
         visitor.append(&thisObject->m_inheritorID);
 
@@ -633,20 +635,23 @@ void JSObject::allocatePropertyStorage(JSGlobalData& globalData, size_t oldSize,
 
     // It's important that this function not rely on structure(), since
     // we might be in the middle of a transition.
-    PropertyStorage newPropertyStorage = 0;
-    newPropertyStorage = new WriteBarrierBase<Unknown>[newSize];
 
     PropertyStorage oldPropertyStorage = m_propertyStorage.get();
-    ASSERT(newPropertyStorage);
+    PropertyStorage newPropertyStorage = 0;
 
-    for (unsigned i = 0; i < oldSize; ++i)
-       newPropertyStorage[i] = oldPropertyStorage[i];
+    if (isUsingInlineStorage()) {
+        if (!globalData.heap.tryAllocateStorage(sizeof(WriteBarrierBase<Unknown>) * newSize, reinterpret_cast<void**>(&newPropertyStorage)))
+            CRASH();
 
-    if (isUsingInlineStorage())
-        Heap::heap(this)->addFinalizer(this, &finalize);
-    else
-        delete [] oldPropertyStorage;
+        for (unsigned i = 0; i < oldSize; ++i)
+            newPropertyStorage[i] = oldPropertyStorage[i];
+    } else {
+        if (!globalData.heap.tryReallocateStorage(reinterpret_cast<void**>(&oldPropertyStorage), sizeof(WriteBarrierBase<Unknown>) * oldSize, sizeof(WriteBarrierBase<Unknown>) * newSize))
+            CRASH();
+        newPropertyStorage = oldPropertyStorage;
+    }
 
+    ASSERT(newPropertyStorage);
     m_propertyStorage.set(globalData, this, newPropertyStorage);
 }
 

diff --git a/Source/JavaScriptCore/runtime/JSObject.h b/Source/JavaScriptCore/runtime/JSObject.h
index 6d45e82..85f0f2c 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSObject.h
+++ b/Source/JavaScriptCore/runtime/JSObject.h
@@ -90,8 +90,6 @@ namespace JSC {
 
         JS_EXPORT_PRIVATE static UString className(const JSObject*);
 
-        static void finalize(JSCell*);
-
         JSValue prototype() const;
         void setPrototype(JSGlobalData&, JSValue prototype);
         bool setPrototypeWithCycleCheck(JSGlobalData&, JSValue prototype);